According to the incidence response plan, which of the following actions best contains any damage caused by a security threat?
A) preserve evidence of damage done
B) reevaluate risk matrix
C) restrict systems access
D) investigate system logs for evidence

Question

Quizplus · Accepted Answer

Restricting system access can help contain the damage caused by the security threat by limiting the attacker's ability to further harm the system or steal more information. This step should be taken immediately to prevent further damage. Preserving evidence and investigating system logs can help identify the source of the security threat, but they come after containment has been achieved. Reevaluating the risk matrix may be necessary later to prevent similar incidents in the future but is not directly related to containing the damage.

According to the Incidence Response Plan, Which of the Following